QFieldCloud with LDAP

[EgidijusViko]

Hello,

Did anyone achive fully working QFieldCloud on local instance with LDAP? Mostly I need User authorization via Domain Controller.

Thank you for any information!

[T4mmi]

Hi, any update on this topic ?

[maviz991]

Any update?

[t-book]

Nice idea! I've worked on LDAP integration on several other projects. Basically one could use https://django-auth-ldap.readthedocs.io/en/latest/ and set up a new auth method.

QFieldCloud/docker-app/qfieldcloud/settings.py

Lines 68 to 73 in 3d4a9cb

	AUTHENTICATION_BACKENDS = [
	"axes.backends.AxesBackend",
	# custom QFC backend that extends the `allauth` specific authentication methods
	# such as login by email, but restricting who can login to only regular users
	"qfieldcloud.authentication.auth_backends.AuthenticationBackend",
	]

Unsure how this affects plans/subscriptions but will have a look as soon as there is some spare time.

Also I wonder if this should go into core / would be accepted or if it would fit better as contrib package f.e. what we did with geonode https://github.com/GeoNode/geonode-contribs

[gounux]

Hi,

Thanks for the question,

QFieldCloud is compatible with OpenID Connect - see this part of the environment for configuration :

QFieldCloud/.env.example

Lines 363 to 373 in 66d1052

	# "openid_connect": {
	# "OAUTH_PKCE_ENABLED": true,
	# "APP": {
	# "provider_id": "keycloak",
	# "name": "Keycloak",
	# "client_id": "<client-id>",
	# "settings": {
	# "server_url": "https://keycloak.local/realms/myrealm/.well-known/openid-configuration"
	# }
	# }
	# }

Basically one could use https://django-auth-ldap.readthedocs.io/en/latest/ and set up a new auth method.

I'm not sure that implementing LDAP auth is planned for the upcoming times or is in the QFieldCloud roadmap,

Though, there might be some different ways to address this, for instance using a configured dex external instance,
Dex can be configured as an OIDC ID provider in QFieldCloud, and it seems feasible to configure an LDAP connector in dex.

Hope this can help, looking forward hearing about your progress :)

[T4mmi]

Other question from a newbie (might totally be irrelevant): from what I understand, OIDC handle the acces to the app, but do you still need to manually create/manage the app accounts.
Is there a way to externalize the "user database management" (as in accounts / groups, even if specific details are set to default values) so we don't have to manually declare users in QFIeldCloud instance ? (use case is : "I wanna enable acces to the instance for all my colleagues, but I don't wanna create the 500+ accounts and track arrivals/departures since it is done by the IT dept in the internal LDAP")

[t-book]

@T4mmi I’m not entirely sure, but my current understanding is something like this:

Looking at QFieldCloud’s adapter:

QFieldCloud/docker-app/qfieldcloud/core/adapters.py

Line 192 in 7112ab7

class SocialAccountAdapter(DefaultSocialAccountAdapter):

it uses DefaultSocialAccountAdapter from django-allauth:

https://docs.allauth.org/en/latest/socialaccount/adapter.html

In allauth, save_user() is called during the social login “signup flow”, when a user logs in via a provider and no existing account is found. According to the docs, in case of auto-signup the signup form is skipped, but the flow still ends up creating and saving a user.

SOCIALACCOUNT_AUTO_SIGNUP is True by default:

https://docs.allauth.org/en/latest/socialaccount/configuration.html

so I think the intended behavior is that a new user gets created automatically on first SSO login (assuming signup is allowed and there are no conflicts.

If this behavior is not what you need, it seems like QFieldCloud already exposes the right extension point: you could override SOCIALACCOUNT_ADAPTER with a custom adapter and control is_open_for_signup() or even save_user() to change whether and how users get created.

QFieldCloud/docker-app/qfieldcloud/settings.py

Line 501 in 7112ab7

SOCIALACCOUNT_ADAPTER = "qfieldcloud.core.adapters.SocialAccountAdapter"

Also worth looking at allauth signals if you need to hook into or debug the login/signup process — they seem intended for that kind of customization.

You can get an idea for extracting other informations or do stuff by looking at how it is done here with geonode:

https://github.com/GeoNode/geonode/blob/f260139ab239250da61bb7b6fd0014275acbdfd9/geonode/people/adapters.py#L213-L248

[T4mmi]

wow thanks a lot for these explanations, it's crystal clear !